The Data Security and Protection Toolkit (DSPT) – submission deadline 31 March 2019.

The Data Security and Protection Toolkit (DSPT) replaced the Information Governance toolkit from April 2018. The DSPT is an online self-assessment toolkit that has to be used by all organisations that have access to NHS patient data and clinical systems.

The submissions deadline is 31 March 2019, so it is best to prepare now as it can take up to three months for a practice to meet the mandatory elements of the DSPT.

What has changed

  1. The DSPT has moved away from levels 1, 2, 3 and towards mandatory evidence items.
  2. Duplication has been removed and the DSPT has more precise requirements.
  3. It is aligned with the 10 data security standards and the General Data Protection Regulation (GDPR).
  4. Practices must complete all of the mandatory items to be deemed ‘satisfactory’.
  5. Practices must now demonstrate that 95% of all staff have received data security training and show understanding of who has access to practice systems as well as demonstrating an awareness of data flows within the practice.

    It is worth noting that if you have mapped your practice data and created a Record of Processing Activity (ROPA) for GDPR then you will already have met this requirement.

How to prepare 

As it can take up to three months for a practice to prepare all of the information required to meet the mandatory assertions it is worth starting to prepare now.

  1. First register your practice on the DSPT.
  2. Then the best place to start is to look at the spreadsheet of assertions and which ones are mandatory for GPs and what evidence is required.
  3. Then look at the e-training available to meet the 95% of all staff to have had security training.
  4. You will need to provide details of your Data Protection Officer (DPO) in your submission, so if you have not yet appointed one or secured DPO services, you will need to do so. Your CCG is required to provide a DPO support service and training, ask them what this will include, if they have yet to provide you with details of this. You could also ask your federation if they have any plans to provide DPO support.
  5. If you have not started mapping your practice’s data flows and/or created a ROPA for your practice, or you are not sure generally where to start with GDPR and DPA 18 compliance, then there is a useful practical resource produced by the NWL IG group with support from an IG consultancy. It takes two practices that are merging through GDPR and DPA 18 compliance, and there is a series of blogs and resources created from this exercise which are helpful in understanding GDPR compliance within a general practice setting, particularly in regard to data mapping and ROPAs. We have been given permission by the NLW IG group to share the link to this resource, but with the awareness that it is not legal advice.

For most practices, the submission to the DSPT will be their first test of GDPR compliance unless they have a CQC (Care Quality Commission) inspection before it. For CQC, all  health and care organisations must assure themselves they are implementing the data security standards and meeting their statutory obligations on data protection and data security. This comes under the CQC’s key line of enquiry W6 which asks: “Is appropriate and accurate information being effectively processed, challenged and acted on?”. It is expected that submissions to the DSPT will help demonstrate how practices are assuring themselves in this area.

Last updated : 25 Jan 2019


Tips of the month July 2019 (16 Jul 2019)

We provide weekly tips based on common queries which come through to us from London GPs and practice teams. These are shared via social media and collated for...
Read more »

Employing Clinical Pharmacists in general practice event (16 Jul 2019)

Funmi Worrell, Programme Manager from Healthy London Partnership and Graham Stretch, Vice-President Primary Care Pharmacy Association, will be attending Londonwide LMCs on 30 July at 11am to talk about the...
Read more »

Workforce survey summer 2019 initial findings (16 Jul 2019)

475 people working across 391 GP practices responded to the survey, representing 32% of the practices in the Londonwide LMCs’ area. Almost two fifths of responding practices have a GP...
Read more »

Upfront charging of overseas patients (16 Jul 2019)

The BMA Annual Representative Meeting last month carried a motion proposed by Dr Jackie Applebee, of Tower Hamlets Division, stating: “That this meeting calls on the BMA to publicly support...
Read more »

BMA Annual Representative Meeting 2019 (16 Jul 2019)

The BMA’s Annual Representative Meeting took place in Belfast from 23-25 June. Notable resolutions passed included those calling for: Capita to be sanctioned for its failures to properly run...
Read more »

Paid for travel vaccination activity not covered by state indemnity (16 Jul 2019)

The Department of Health and Social Care (DHSC) and NHS Resolution have confirmed that the Clinical Negligence Scheme for General Practice (CNSGP) does not cover the supply and administration of...
Read more »

Dr Michelle Drage awarded BMA Medal (16 Jul 2019)

On 26 June at the BMA Annual Representative Meeting in Belfast, Dr Michelle Drage, our Chief Executive, was awarded the Association Medal in recognition of her “distinguished service to the...
Read more »

Patient Access service update - proxy access now available (16 Jul 2019)

Patient Access have recently updated their service to allow proxy access.    Proxy access is designed for those who need to use the service on behalf of someone else; this...
Read more »

Primary care networks (PCN) update – July 2019 (16 Jul 2019)

The start of this month saw the deadline for primary care networks to be finalised with CCGs. There have been a number of developments since our last newsletter: PCN process...
Read more »

Digital Roundtable event and practice nurse Action Learning Set (16 Jul 2019)

On 3 July we hosted a Digital Roundtable for IT leads and practice managers. Speakers included representatives from the Primary Care Digital Transformation team at NHS England and our own...
Read more »
Next Page »